Application Protocol Analytics GCDA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security analyst is reviewing network traffic and notices that an internal client is sending HTTP requests to a web server with the following pattern: the URI contains encoded characters that decode to SQL syntax, and the requests are repeated with slight variations. The analyst suspects a SQL injection attempt. Which additional observation would most strongly support this hypothesis?

   • AThe requests are all GET requests to the same URI, and the response sizes vary significantly from normal responses.
   • BThe requests use HTTP/1.1 and include a Host header.
   • CThe HTTP User-Agent header is a common web browser string.
   • DThe requests come from a single source IP address and are spaced evenly over time.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   A network analyst observes traffic on TCP port 445 between two internal hosts. Which application protocol is most likely being used?

   • ASMTP
   • BHTTP
   • CDNS
   • DSMB
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During a hunt, you observe a workstation making repeated connections to an external IP on TCP port 443. The TLS certificate presented is self-signed and the SNI field contains a random-looking alphanumeric string. The user denies visiting any unusual websites. Which additional evidence would most strongly indicate that this is not normal HTTPS web browsing?

   • AThe certificate's Subject Common Name matches the SNI string, and the connection occurs at regular 5-minute intervals.
   • BThe user's browser history shows visits to a news site at the same time as the connections.
   • CThe destination IP is in a cloud provider range and the connection lasts less than one second.
   • DThe workstation's DNS resolver cache contains an entry for the destination hostname.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A detection team is investigating a potential data exfiltration via HTTPS. They have network visibility but no access to the client or server. The traffic is to a well-known cloud storage service, and the volume is consistent with normal business use. The team needs to determine if the traffic is malicious without disrupting business operations. Which approach best balances the need for detection with the constraint of not decrypting traffic?

   • AUse a passive TLS fingerprinting tool to identify the client software and compare it to known malware signatures.
   • BBlock all traffic to the cloud storage service until the investigation is complete.
   • CBaseline the normal usage patterns for each user and flag deviations in timing, volume, or destination that cannot be explained by business needs.
   • DDeploy a TLS interception proxy and decrypt all traffic to the cloud service for inspection.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   You are analyzing TLS traffic and notice that a client is using a very old TLS version (TLS 1.0) to connect to an internal server. The server is a modern application server. What is the most appropriate action?

   • AImmediately block all TLS 1.0 traffic.
   • BFlag the traffic as anomalous and investigate why the client is using an outdated protocol.
   • CAssume the server is compromised because it accepts TLS 1.0.
   • DIgnore it because TLS 1.0 is still supported by many systems.
   Reveal Solution Discussion Select an answer first